RE: RPC over HTTP security

[Shawn Wall <sjwall () shaw ca>]

I'd have to agree with Eric on this one. SSL is a proven encryption method.
Billions of dollars are transefer via SSL encypted sites every year. If was
as trivial to 'hack' as you suggest, Kevin, I don't think it would be in
use. Perhaps you could do as Eric suggested and provide some factual proof.

shawn 

-----Original Message-----
From: Eric McCarty [mailto:eric () piteduncan com] 
Sent: Friday, January 28, 2005 10:35 AM
To: Kevin Doheny; Shawn Wall; sf_mail_sbm () yahoo com;
security-basics () securityfocus com
Subject: RE: RPC over HTTP security

Your joking right.

"SSL in and of itself provides very little security"

That's why most of the internet uses it right?. 

Your gonna have to back up statements like yours with some serious factual
backing otherwise your comments will be discarded as B.S coming form someone
who doesn't know what they are talking about.

E. 

-----Original Message-----
From: Kevin Doheny [mailto:kdoheny () CNP net]
Sent: Friday, January 28, 2005 5:06 AM
To: Shawn Wall; sf_mail_sbm () yahoo com; security-basics () securityfocus com
Subject: RE: RPC over HTTP security

SSL in and of itself provides very little security... Way to easy to hack.
Look into a Neoteris (now Juniper) SSL VPN/Proxy.  This way evil hack3r can
not ride the SSL stream into your network and past any IDS or IPS systems. 

Kevin 

-----Original Message-----
From: Shawn Wall [mailto:sjwall () shaw ca]
Sent: Wednesday, January 26, 2005 11:04 PM
To: sf_mail_sbm () yahoo com; security-basics () securityfocus com
Subject: RE: RPC over HTTP security

Are you using Exchange? Why not use OWA and secure it with SSL?

shawn 

-----Original Message-----
From: sf_mail_sbm () yahoo com [mailto:sf_mail_sbm () yahoo com]
Sent: Wednesday, January 26, 2005 6:03 AM
To: security-basics () securityfocus com
Subject: RPC over HTTP security



Hi List,
We are thinking about deploying RPC over HTTP to access email from the
Internet

Wanted to get some information on the technology and the security
implications of same

Not much info from Microsoft's site

any help would be greatly apreciated

Thanks,
Ronish